Easy Internet Privacy is a Snipe Hunt

2014-10-28 Anonabox

Earlier this month there were all kinds of stories about an infamous new product on Kickstarter: Anonabox. As Wired related, Anonabox was supposed to be a simple-to-use router that would let anyone easily use the Tor anonymity network. According to Wikipedia, “Tor directs Internet traffic through a free, worldwide, volunteer network consisting of more than five thousand relays[6] to conceal a user’s location and usage from anyone conducting network surveillance or traffic analysis.” The problem is that Tor–like a lot of techniques for anonymizing your Internet usage–requires a little bit of know-how to set up. The Anonabox was supposed to make it ultra-simple, and as a result it quickly raised hundreds of thousands of dollars.

Controversy quickly followed, however, starting with skepticism that Anonabox was built on a custom board and case; it turned out that the hardware was basically off-the-shelf. Even more serious criticisms soon followed, however:

But as the security community has taken notice of Anonabox over the last week, its analysts and penetration testers have found that the router’s software also has serious problems, ones that could punch holes in its Tor protections or even allow a user to be more easily tracked than if they were connecting to the unprotected Internet. “I’m seeing these really strange smells and poor practices in their pilot beta code,” says Justin Steven, a computer security analyst based in Brisbane, Australia. “It scares me if anyone is relying on this for their security.”

Eventually, Kickstarter decided to suspend the campaign. So the Anonabox itself is (at least for the time being) a non-issue. But here’s the bigger picture. Only three types of people are likely to create a new technology (hardware or software) to help people retain greater privacy online:

  1. Scammers
  2. The NSA
  3. Genuine privacy advocates

Scammers aren’t going to bother building serious, robust anonymity into their products and services. The NSA (or similar entities) probably would do a decent job, but obviously with a backdoor to allow them to have access when they wanted. Only genuine privacy advocates are even going to make an attempt to create a legitimately anonymous product or service, and there’s no guarantee that they would succeed. There are no shortcuts and there are no guarantees to online privacy and security.

In some ways, this isn’t news. Security (online or offline) is never actually about preventing loss, tampering, or theft. Whether it’s data or diamonds you’re trying to protect, the reality is that you can’t deny access to someone with the means and the motive to get at your stuff. All you can do is make it more expensive and hope that the expense turns out to be not worth the bother.

Still, it’s probably good to give people a dash of reality when it comes to security and privacy. Looking for easy and effective security solutions is a snipe hunt. They don’t exist. In the end you’re just gonna have to trust some software that you can’t read (because it’s closed source) or don’t have time to understand (if it’s open source). Remember Heartbleed? It was discovered in April 2014. It had been present since December 2011 and in widespread use since March 2012. That’s open-source software: anyone could read the code. For over two years, however, no one did. And this is code that was running on nearly 20% of the secure web servers on the Internet!

And Heartbleed isn’t the exception. It is, in many ways, the rule. Snapchat gained widespread fame and use because it was supposed to delete messages after they were read instead of keeping a permanent record. Great for privacy, right? Not so fast:

Snapchat has long marketed itself as a private and more secure alternative to services like Facebook and its subsidiary Instagram. The app lets users send photo and video messages that disappear once they are viewed. That self-destruct feature initially gave the app a reputation as a favorite tool for so-called sexters, or those who send sexually suggestive photos of themselves, but eventually it went mainstream…

But security researchers have long criticized Snapchat, saying it provides a false sense of security. They say the app’s disappearing act is illusory. Behind the scenes, Snapchat stores information about its users in a database, similar to data storage at other big Internet companies.

I’m not saying that you should just give up on securing your data online. But once you’ve taken the normal steps–strong passwords, 2-factor authentication, etc.–you should keep in mind that your security is not perfect. To the extent that your data remains secure it’s because you’re too boring and insignificant to attract anyone’s attention. Not because your security is so effective.